KR20080007671A - Wireless communication network security method and system - Google Patents

Abstract

A security method (100) in a radio access network can include monitoring (102) (by either a base station controller or a mobile radio) for one or more abnormalities among CPU utilization, memory storage, memory read-write, malicious incoming or outgoing messages, and virus file names, notifying (104) of a specific abnormality detected, and receiving (108) access, conditional access or limited access based on the specific abnormality detected. The method can further include receiving updates (112) used for monitoring the abnormalities. The method can further include the optional step (106) of issuing a notification from a mobile radio to a base station controller if the specific abnormality is detected and suspending (110) one or more services based on the specific abnormality detected. The method can further include receiving (114) at the mobile radio an over the air programming instruction to suspend a specific service and alerting the mobile radio.

Description

[0001] WIRELESS COMMUNICATION NETWORK SECURITY METHOD AND SYSTEM [0002]

The present invention generally relates to methods and systems for protecting wireless communication networks from security breaches and malicious attacks, and more particularly, to a method and system for protecting a wireless communication network from the use of software in communication systems capable of mitigating or eliminating such security breaches or attacks Or methods and systems in a mobile radio station or base station.

Advances in mobile technology from simple telephones with the same capabilities as classifier organizers to more intelligent and sophisticated compact computing devices, including games, video streaming, or web-based applications, have become one of the goals of mobile manufacturers . In recent years, mobile phone market players have been aiming to provide more features that users are demanding in an attempt to increase user penetration. As these additional implemented features and functions are more user-oriented and better governed, the vulnerabilities in the associated technology are also increasing.

Most of the countermeasures for wireless security are focused on authentication and encryption technologies that generally refuse to use, so no attention is paid to mobile security when the user is already authenticated on the mobile radio. Security experts have warned enough about the improvements required in these areas. There is no technology to prevent hackers, and recent upheavals such as the "Cabir" virus, which infects Symbian operating systems running on a number of mobile radios, including Nokia, The evidence. CNN's Diana Muriel, in his article entitled "Threat of mobile virus attack real," dated Oct. 15, 2003, states that the "Windows operating system has more than 60,000 viruses I have been in a state of being attacked, "he said, and this trend will be driven not only by many imitators, but also by new forms of security. Therefore, before these problems get out of control, intrusion detection and resolution methods need to be introduced and implemented. Once a mobile station is infected, it can propagate malicious chain reactions of attacks (mutation attacks) to other mobile stations in the network as well as the network itself.

Currently, there are authentication and encryption technologies being proposed to IS200C / D and other wireless standards. These proposals, however, are for complete denial of unauthenticated users or for data integrity of users and may only block or suspend certain infected portable mobile devices or certain services of malicious mobile devices, Malicious mobile devices access the wireless network to prevent potentially damaging the entire system by causing system downtime, reduced service to other users, system overflow with malicious traffic, or one or more of chain reaction or infection There is no special implementation or technique to do this.

<Overview>

Embodiments in accordance with the present invention can provide prevention, detection, and / or recovery from attacks on a mobile station or its infrastructure by reducing or suppressing the effects that a virus may have on the infrastructure or other mobile phones . These embodiments help to detect any intrusions as well as situations where the virus has already infected the mobile station or radio access network. Current mobile architectures and infrastructure structures are lacking or lack of protection against intrusions that may become more apparent when verifying and resolving that mobile stations and associated services are completely compromised.

A first embodiment of the present invention is a method for security of a radio access network comprising the steps of: using a CPU utilization (by a base station controller or mobile station in a radio access network), memory storage, memory read-write, malicious input or output messages, Conditional abnormality, notification of a specific abnormal condition detected via a wireless communication link, and access via the wireless communication link based on the detected abnormal condition, Access or limited access may be included. The method may further comprise receiving an update used to monitor the one or more abnormal conditions. The method may further include issuing a notification from the mobile station to the base station if the specific abnormal condition is detected and stopping one or more services provided to the mobile station based on the detected specific abnormal condition . In this regard, the method may comprise issuing a notification from a mobile station and sending a response to the mobile station to perform one of a data service stop, a data service and a voice service stop, a data service stop cancellation, From the base station controller. The method may further comprise receiving an over-the-air (OTA) programming command for stopping a specific service at the mobile station and alerting the mobile station. The method may further include isolating the mobile station operating system from the air interface layer. In this way, a denial of service (DoS) attack can be prevented by monitoring the operation of the mobile station communicating with the radio access network and flagging the detected abnormal condition. In addition, upon detection of a malicious software routine at the mobile station, the packet data service at the mobile station can be stopped while enabling the voice or line data call.

In a second embodiment of the invention, the radio access network security system may comprise a transceiver and a processor coupled to the transceiver. The processor monitors one or more abnormal conditions of CPU utilization, memory storage, memory read-write, malicious input or output messages, and virus file names, notifies of certain abnormal conditions detected via a wireless communication link, Conditional access or restrictive access over the wireless communication link based on a particular abnormal condition that has occurred. If an abnormal condition is detected, the system may perform the following functions: a function to disable the infected service for a predetermined period of time, a function to reject the allocation of resources for the flagged application, redirecting functionality, directing other geographically proximate mobile stations to raise the security level, directing other geographically proximate mobile stations to execute the virus software (e.g., removing any existing infections, Setting to a higher level to prevent future infections or to download the latest virus software updates), the ability to prohibit peer-to-peer communications, the address book of the mobile station, a buddy list, or recent calls A function of inhibiting access to the list, And a function of instructing the mobile station to enter the location search mode, and a function of instructing the mobile station to enter the location search mode.

In a third embodiment of the invention, the radio access network system may comprise a transceiver and a processor coupled to the transceiver. Wherein the processor is configured to monitor an anomaly of an application in a mobile station communicating with the radio access network system (virus, mismatch location, etc.) and to enable access of the mobile station to other resources on the radio access network system, May be programmed to selectively control access of the mobile station to resources on the system and to perform one or more mitigation functions to mitigate effects of the abnormal condition on the radio access network system. The processor is capable of limiting access to the following functions: mobile station (infected mobile station, or other mobile station capable of communicating with the infected mobile station), address book, friend list or recent call list, The ability to raise the security level of a wireless device with potential communication with the mobile station (considering again, address book, friend list, recent call list, hot list, etc.), the ability to restrict access to a particular service application, The access to the resource can be controlled by performing one or more functions selected from the functions for redirecting the service to the less sensitive service. The one or more mitigation functions include at least the following functions: a function of alerting other mobile stations close to the mobile station of the abnormal state, raising a security level or executing virus software, A function of instructing the mobile station to deplete the mobile station, or a function of enabling the location tracking of the mobile station. The term " nearby "is not limited to locally and physically adjacent mobile stations, but may also optionally include mobile stations that may potentially contact an infected mobile station. For example, commands and warnings that raise security levels or execute virus software may be sent to neighboring mobile stations, which may be stored in memory locations of the mobile station (address book, buddy list, recent call list, To other mobile stations in the memory repository in the associated radio access network.

Other embodiments configured in accordance with the invention disclosed herein may include a machine-readable storage medium for causing a system and a machine to perform the various processes and methods disclosed herein.

Figure 1 illustrates a number of attacks that are susceptible to mobile stations and infrastructure according to embodiments of the present invention.

2 shows a block diagram of a radio access network including a mobile station according to an embodiment of the present invention.

Figure 3 shows a modified table of the "RETURN_CAUSE" code that may be used in accordance with an embodiment of the present invention.

FIG. 4 illustrates a table of Assignment Mode codes according to an embodiment of the present invention.

5 shows a timing diagram of notification and stopping of services supported by the mobile station using the update according to the embodiment of the present invention when the mobile station is in the idle mode.

6 shows a timing diagram of notification and stopping of services supported by the mobile station using the update according to the embodiment of the present invention when the mobile station is in the active mode.

7 shows a packet control function for monitoring packets in a base station controller according to an embodiment of the present invention.

8 is a timing diagram of notification and stopping of services supported by the base station controller using the update according to the embodiment of the present invention.

9 shows a flowchart of a method of securing a radio access network according to an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS While the specification concludes with claims defining the features of the embodiments of the invention that are regarded as novel, the invention will be better understood by reference to the following detailed description when taken in conjunction with the drawings in which like reference numerals are used .

Embodiments herein may include a combination of implementations and algorithms that operate between a portable mobile device (such as a mobile radio or a wirelessly accessible laptop computer) and wireless access network software. In one embodiment, software can be used as an automatic response mechanism to compensate for the various problems described above by issuing a notification and / or a stop for the service in accordance with the specific problem in question. An approximate list of some attacks that may be defended against using some of the embodiments herein is shown in FIG. 1, which illustrates physical access attacks such as wiretapping, server hacking, vandalism, such as dialogue attacks, eavesdropping, impersonation, message change, scanning (scanning or probing), break-in, denial of service ("DoS"), malware Penetration attacks such as viruses, worms, and social engineering such as opening attachments, stealing passwords, stealing information, and the like.

2, a wireless network system 10 according to an embodiment of the present invention includes a base station controller (BSC) 12 having a mobile radio 12 such as a mobile phone and a packet control function 21 20). BSC 20 includes one or more base station transceivers 18, a visitor location register (VLR) 24, and a packet data serving node (PDSN) 24 forming part of a visited access provider network (Not shown). The VLR 24 may be connected to the home location register (HLR) via the SS7 network or mobile switching center 26. The PDSN 22 may be connected directly to one or more servers (such as connected to the server 30), connected directly to the server 34 (e.g., for a home network), server 36 ), A home agent server 38 (e.g., for a home IP network, a private network, or a home access provider network), or an IP network 32 such as connected to a security related server 40.

The mobile station 12 is an application for filtering and detection that exists between the mobile station operating system (OS) 15 and the air-interface layer-2 call control layer 17 (or alternatively may be embedded within the OS kernel) An application having a program interface (API) 16 and a control block 12. In the role of filtering and detection, the API 16 monitors anomalies such as CPU efficiency, memory storage, memory read / write, malicious input / output files / messages, and known virus file names (Trojan, sasser, etc.). A software application for this may be obtained from a shelf, implemented in the mobile station 12, and specified for the OS, but the implementations are not necessarily limited to a particular OS. Also, the known virus file name can be obtained over-the-air via OTAPA between the BSC 20 and the mobile station or upon an update request by the user, both of which are known viruses, software patches , And an update 42 for other security related information.

One of the "abnormalities" that can be detected in addition to the infected application on the mobile station may include the location reported by the mobile station that is inconsistent with the location reported by the base station or the radio access network communicating with this mobile station . If an anomaly is found, air interface messaging can be used to reject resources for an offending mobile station in an optional manner (HTTP, FTP, mail (SMTP + POP3), ICMP, stop). In one example using the CDMA2000 protocol, the FTCHServiceOptionControl function may be used to prevent an offending service from operating for a predetermined time. Another alternative may be to refuse the resource allocation for the abnormal application, or to redirect the service to a similar service or other carrier that does not provide the data service, for example. The system can also track infected users or infectious spreaders by creating location queries that can provide base station transceiver station location or mobile station location among others based on GPS, triangulation, or other neighboring communication device IDs I can help.

In another example where infection or anomaly is detected, the system may grant resources for voice calls, especially 911 calls or other emergency calls, while rejecting data services and other services that are susceptible to spreading anomalous attacks. Even if the mobile station is somewhat contaminated and repeatedly attempts to make a 911 call, the system accordingly detects the call disconnected by the 911 operator, provides an indication that the call is not real, You can generate flags such as priority or fake calls.

In addition, if an infection or an anomaly is detected, the system may instruct the geographically adjacent mobile stations to raise the security level or alternatively to execute the virus software. The system may also include forbidding peer-to-peer communications, such as Bluetooth communications, to prevent or mitigate the spread of this infection to other mobile stations. In addition, access to the mobile station's address book, buddy list, or recent call list may be denied and alert and instruct the devices corresponding to the mobile station's address book, buddy list, or recent call list to raise the security level . In another attempt to mitigate the infection, the system may attempt to deplete the battery life of the battery operated mobile station in several ways. For example, a mobile station can be instructed to enter an &quot; unslotted mode &quot; (which is QPCH / PICH turned off) that depletes battery life more quickly and effectively, thereby eliminating potentially possible problems more quickly. In addition, the mobile station can be instructed to enter the tracking mode so that the position of the mobile station can be easily found. Also, by instructing the mobile station to enter a more precise tracking mode, battery life can be depleted more quickly.

API 16 can monitor IP, provide intrusion detection, and provide policy enforcement for a particular OS. For example, the API 16 may verify that no buffer overflow has occurred that would allow an arbitrary program to acquire system resources, and may also be used for MID / ESN (mobile identification or electronic serial number is not transmitted / reprogrammed. The API 16 also intercepts and isolates the OS 15 and the air-interface layer-2 call control 17. When the mobile station OS 15 is infected, the API 16 blocks the Layer-2 call control layer 7 from infection (depending on the service option or attempted call type) Can continue to operate. The API 16 may also periodically provide feedback to the call control block 17 for critical data for determination and updating.

Layer 2 and Layer 3 call control in the mobile phone may be in an Idle, Dormant, or Active state. When the mobile station OS 15 and the application receive critical data from the API 16 that is compromised (idle), the call control layer 17 may contain an element_field expression or a "compromised & To the radio access network (RAN) via an explicit origination message (see "RETURN_CAUSE" in table code "0110 " in FIG. 3) Assignment Message) to wait for a response from the RAN. Based on the GRANTED_MODE (code "101" shown in FIG. 4), the layer-2 or layer-3 call control block 17 alerts the user of the mobile station 12 to take action and starts to stop the service will be.

If the mobile station 12 is in the active state, the layer-2 call control block 17 releases the call, terminates the PPP session locally, and sends an explicit origination message to the RAN. If the mobile station 12 is idle, the layer-2 call control block 17 locally terminates the PPP session and sends an explicit origination message to the RAN. During the suspension state, the call control block 17 monitors the feedback data from the API 16 to determine whether the paused state is continued or canceled, and sends the RAN an indication that the infected RETURN_CAUSE (see FIG. 3) of "0111" indicating that the service is erased. The layer 17 may also monitor the OTAPA related configuration for the services supported by the BSC 20.

Referring to Figures 3 and 4, the proposed message and message elements are mapped to Explicit Origination, General Page, Page Response, and ECAM codes used in the CDMA2000 signaling standard . With the plicit Origination, the "RETURN_CAUSE" message element is set as in the modified Table 2.7.1.3.2.1, as shown in FIG. 3, to provide "CDMA 2000 " for spread spectrum systems Quot; upper layer (layer 3) signaling standard "of &lt; / RTI &gt; Similarly, an Assignment Mode similar to Table 3.7.2.3.2.21-1. From the upper layer (layer 3) signaling standard of CDMA 2000 for the spread spectrum system shown in FIG. 4 and a standard that can implement GRANTED_MODE An explicit ECAN (Explicit ECAM) message can be implemented without changing the value of ASSIGN_MODE = '101', using the new ASSIGN_MODE as shown in FIG. 4, a GRANTED_MODE message element can be set, A record field 00 (for stopping the canceled data service), 01 (for stopping the canceled voice and data service), 10 (for stopping the data service), and 10 (for stopping the voice and data service) 0.0 &gt; GRANTED_MODE &lt; / RTI &gt; (e.g.

  The Explicit General Page Message may be a SPECIAL_SERVICE message proposed for an implementation supported by the BSC for a mobile radio-addressed page. In general, this message length is one bit, but in the present embodiment, Field_Length is increased to 2 bits, so that 00 (for stopping the canceled data service), 01 (for stopping the canceled voice and data service) (For stopping the service) and a Field_Length of 2 bits for 11 SPECIAL_SERVICE 2 codes (for stopping voice and data services). Finally, the Explicit Page Response Message may be an acknowledgment to an Explicit General Page Message or a Page Response modified as an ACK.

In implementing a radio access network (RAN) to provide a defense mechanism to be considered here, an enhanced algorithm for receiving an explicit origination message and granting or denying mobile station services via an ECAM- 4 using the Assign Mode table shown in FIG. While the mobile station is stationary, the RAN stores an explicit origination message for all updates and continues monitoring.

The stop operation may be supported by the mobile station, supported by the BSC, or both. In the mobile station-assisted manner, when the mobile station is "idle ", the RAN monitors the explicit origination message and checks the compromised flag and, based on the user profile and / or configuration parameters, The BSC monitors the explicit origination message, identifies the corruption flag, and sends a PPP (e.g., via the A10 / A11 RP interface) as shown in FIG. 5 The BSC notifies the PDSN 22 to terminate the session and sends the ECAM message to the GRANTED_MODE set to one of 10_data service stop or 11_voice and data service stop. In the "active state", if the mobile station is in an active data session, Monitors the mobile_release message and the explicit originating message, verifies the corruption flag, and sends the ECAM message to one of the defined GRANTED_MODE codes The RAN or BSC 20 monitors the Mobile_release message and the explicit origination message and sends the ECAM message to one of the defined &lt; RTI ID = 0.0 &gt; GRANTED_MOde &lt; Message to the BSC 20. If the mobile station is in the shutdown or quiescent state, the BSC 20 may verify the stored parameters and the BSC 20 will notify the mobile station of a busy tone to all callers without paging. The mobile station may be configured to receive the known virus update over-the-air via OTAPA. As an alternative, the OTAPA may be used to stop the mobile station specific service and alert the user accordingly.

In a base station controller-supported implementation of the radio access network security system, a Packet Control Function (PCF) acts as a passive proxy / relay agent, and the mobile-client and server (PDSN) A8 / A9 A10 / A11) between the IP sessions (PPP sessions). This implementation may be part of a defense-in-depth scheme to provide detection and pause / notification layers. This provides yet another in-depth detection layer in the network. Referring to Figures 2, 7 and 8, the PCF can act as a passive proxy / relay agent monitoring (A8 / A9 & RP-interface) data packets. For example, the PCF can monitor and identify a malicious fragment IP packet pattern that may contain IP fragment packets, which are legitimate IP packets, except when the combined packets become malicious without decomposing. The PCF may also include an unknown application IP UDP / TCP port number, an abnormal PPP renegotiation (potential PPP session hijacking), a datagram with <{min [negotiated MTU]} or> {max [MTU] And continuous ICMP pings to any destination IP address for the destination IP address. (OMCR) may be configured to continuously update a newly known malicious traffic pattern. PCF can also validate and analyze wireless programming (RF) -interface traffic in real time and compare it to well-known stored traffic patterns or ISP database warehouse servers.

The PCF also notifies the layer-3 call control block to stop the mobile service by releasing the RF resource, disassembling the PPP session, and sending an explicit general page message to the defined "SPECIAL_SERVICE" message element , The layer-3 call control block 17 as a response agent. The PCF may then enable recording and storing of mobile station data using an SCR (Selective Call Listener) update and update the MSC / HLR / VLR. The PCF may also initiate a patch or suspension service update to the mobile station 12 via OTAPA.

9, a flow diagram illustrating a security method 100 in a wireless access network may include a CPU utilization, memory storage, memory read-write, malicious input or output message (by one of the base station controllers or mobile stations in the wireless access network) (102) of detecting one or more abnormal conditions of the virus file name, notification of a specific abnormal condition detected via the wireless communication link (104), detection of the abnormal abnormal condition detected via the wireless communication link (108) controlling or receiving access, conditional access or limited access, and mitigating the effects of anomalies on the radio access network (109). The method 100 may further include receiving (112) an update used to monitor one or more abnormal conditions. The method (100) further includes the steps of: (106) issuing a notification from the mobile station to the base station controller if a particular abnormal condition is detected; and stopping one or more services provided to the mobile station based on the detected abnormal condition (110). In response, the method 100 issues a notification from the mobile station and notifies the base station controller of one of a data service stop, a data service and voice service policy, a data service cancellation, and a data service and a voice service cancellation function And a step of receiving a response to cause the mobile terminal to perform the steps of: The method may further include receiving (114) over-the-air (OTA) programming instructions to cause the mobile station to suspend a particular service and alert the mobile station. The method 100 may further comprise isolating 116 the mobile station operating system from the air interface layer. In this way, a denial of service (DoS) attack can be prevented by monitoring the status of the mobile station communicating with the radio access network and flagging the specific abnormal condition detected. Also, while continuing to enable the voice or line data call, the packet data service at the mobile station may be stopped if a malicious software routine is detected at the mobile station.

With the announcement that random viruses, worms or other malicious programs have landed on mobile phone platforms, as well as advances and great achievements in the wireless network industry by the RAN with the integration of technology and more devices, Is becoming more important than ever before. Currently, there are ways to protect the two ends of a wireless system, i. E., Mainly mobile stations and the Internet, but with the integration of all these technologies, the RAN itself can be monitored or maliciously abused, Can lead to DoS scenarios.

The embodiments herein provide a means for solving some security risks involved when such networks and technologies are integrated. These embodiments may be designed to protect the core RAN system and may prevent overload of the RAN system resources by the MS by monitoring the state of the mobile subscriber (MS) and looking for a specific pattern.

These embodiments may be implemented to deny mobile station access to system resources based solely on infected process / phone capabilities. For example, if the MS contains malicious software that reprograms the mobile station's ESN or MID for a request for more system resources for packet data service, only call origination with this service option is rejected, Line data calls are allowed. This flow may indicate that the mobile station informs the RAN of this operation and determines how the RAN will handle it. In addition to receiving new information on how the mobile station is currently handling the problem, the mobile station can periodically update the RAN during its operation. As part of a "defense-in-depth" topology, a BSC-supported embodiment during a mobile station active data session may provide different layers for detection and notification. These embodiments are not limited to CDMA technology, but may be equally applied to other wireless technologies such as WLAN, WiFi, WiMax, WCDMA, HSDPA, UMTS, and the like.

In accordance with the foregoing detailed description, it is to be understood that embodiments in accordance with the present invention may be implemented in hardware, software, or a combination of hardware and software. A network or system according to the present invention may be realized in a centralized manner in one computer system or processor, or in a distributed fashion in which different elements are distributed across several interconnected computer systems or processors (such as microprocessors and DSPs) Can be realized. Any type of computer system or other device adapted to perform the above functions is possible. A typical combination of hardware and software can be a general purpose computer system with a computer program that, when loaded and executed, controls the computer system to perform the functions described above.

In accordance with the foregoing detailed description, embodiments according to the present invention may be realized in various configurations deemed to be within the scope and spirit of the claims. In addition, the foregoing detailed description is intended to be illustrative only, and is not intended to limit the invention in any way, except as set forth in the following claims.

Claims (10)

A wireless access network security method comprising: Monitoring one or more abnormalities in CPU utilization, memory storage, memory read-write, malicious incoming and outgoing messages, and virus file names; Notifying a specific abnormal condition detected via a wireless communication link; And Receiving access, conditional access or limited access over the wireless communication link based on the detected specific abnormal condition, &Lt; / RTI &gt; The method according to claim 1, Receiving an update used to monitor the one or more abnormal conditions &Lt; / RTI &gt; The method according to claim 1, A notification is issued from the mobile station and a response is received from the base station controller to cause the mobile station to perform one of the following functions: data service stop, data service and voice service stop, data service stop cancel, Step &Lt; / RTI &gt; The method according to claim 1, Receiving an over-the-air (OTA) programming command to stop a specific service at a mobile station, and alerting the mobile station. The method according to claim 1, Monitoring the operation of a mobile station communicating with the radio access network and preventing a denial of service attack by flagging the detected abnormal condition; &Lt; / RTI &gt; 1. A wireless access network security system, Transceiver; And A processor coupled to the transceiver Lt; / RTI &gt; The processor comprising: Monitoring one or more abnormal states of CPU utilization, memory storage, memory read-write, malicious input or output messages, and virus file names; Notify of a specific abnormal condition detected via a wireless communication link; Conditional access or limited access over the wireless communication link based on the detected specific abnormal condition. system. The method according to claim 6, The system includes a mobile station, The mobile station is programmed to issue a notification from the mobile station to the base station controller when the specific abnormal condition is detected, The system comprises: A function of disabling an infected service for a predetermined time, The ability to reject resource assignments for flagged applications, A function of redirecting similar services to the mobile station, A function of instructing other mobile stations that are close in locality to raise the security level, The ability to direct other geographically proximate mobile stations to run virus software, A function for prohibiting peer-to-peer communications, A function of prohibiting access to the mobile station address book by another wireless device which appears to be reliable in a normal state, The ability to raise the security level in the mobile stations in recent communication with the mobile station or in the address book, buddy list or recent call list of the mobile station, A function of instructing the mobile station to enter the battery depletion mode, or Performing at least one of the functions of instructing the mobile station to enter the location search mode system. The method according to claim 6, The system also issues a response to issue a notification from the mobile station and cause the mobile station to perform one of the following functions: data service stop, data service and voice service stop, data service stop cancel, and data service and voice service stop cancel A system that is programmed to receive from a base station controller. 1. A wireless access network system, Transceiver; And A processor coupled to the transceiver Lt; / RTI &gt; The processor comprising: Detecting an abnormal state of an application in a mobile station communicating with the radio access network system; In response to the detection of the abnormal state, Selectively controlling access of the mobile station to resources on the radio access network system while enabling access of the mobile station to other resources on the radio access network system; And performing one or more mitigation functions to mitigate effects of the abnormal condition on the wireless access network system Wireless access network system. 10. The method of claim 9, The processor comprising: A function of restricting access to the mobile station address book by another wireless device which appears to be in a steady state, The ability to raise the security level in the mobile stations in recent communication with the mobile station or in the address book, buddy list or recent call list of the mobile station, The ability to restrict access to specific service applications, or Controlling access to the resource by performing one or more functions selected from a function of redirecting the service to a less sensitive service, The one or more mitigating functions may include at least To alert other mobile stations close to the mobile station of the abnormal state, to raise the security level or to execute the virus software, A function of instructing the mobile station to deplete the power source by waking up the page more frequently, or From the function of instructing the mobile station to deplete the power of the mobile station by instructing the mobile station to perform more accurate position tracking Wireless access network system.

Images